{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T19:58:43Z","timestamp":1784231923182,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":18,"publisher":"ACM","license":[{"start":{"date-parts":[[2017,4,2]],"date-time":"2017-04-02T00:00:00Z","timestamp":1491091200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100006754","name":"Army Research Laboratory","doi-asserted-by":"publisher","award":["W911NF-13-2-0045"],"award-info":[{"award-number":["W911NF-13-2-0045"]}],"id":[{"id":"10.13039\/100006754","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2017,4,2]]},"DOI":"10.1145\/3052973.3053009","type":"proceedings-article","created":{"date-parts":[[2017,3,31]],"date-time":"2017-03-31T08:22:54Z","timestamp":1490948574000},"page":"506-519","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2355,"title":["Practical Black-Box Attacks against Machine Learning"],"prefix":"10.1145","author":[{"given":"Nicolas","family":"Papernot","sequence":"first","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"McDaniel","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ian","family":"Goodfellow","sequence":"additional","affiliation":[{"name":"OpenAI, San Francisco, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Somesh","family":"Jha","sequence":"additional","affiliation":[{"name":"University of Wisconsin, Madison, WI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Z. Berkay","family":"Celik","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ananthram","family":"Swami","sequence":"additional","affiliation":[{"name":"US Army Research Laboratory, Adelphi, MD, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,4,2]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"key":"e_1_3_2_1_2_1","first-page":"387","volume-title":"Machine Learning and Knowledge Discovery in Databases","author":"Biggio Battista","year":"2013","unstructured":"Battista Biggio , Evasion attacks against machine learning at test time . In Machine Learning and Knowledge Discovery in Databases , pages 387 -- 402 . Springer , 2013 . Battista Biggio, et al. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases, pages 387--402. Springer, 2013."},{"key":"e_1_3_2_1_3_1","volume-title":"Deep learning. Book in preparation for MIT Press (www.deeplearningbook.org)","author":"Goodfellow Ian","year":"2016","unstructured":"Ian Goodfellow , Deep learning. Book in preparation for MIT Press (www.deeplearningbook.org) , 2016 . Ian Goodfellow, et al. Deep learning. Book in preparation for MIT Press (www.deeplearningbook.org), 2016."},{"key":"e_1_3_2_1_4_1","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Goodfellow Ian J","year":"2015","unstructured":"Ian J Goodfellow , Explaining and harnessing adversarial examples . In Proceedings of the International Conference on Learning Representations , 2015 . Ian J Goodfellow, et al. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations, 2015."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_2_1_6_1","volume-title":"Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin , Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 , 2016 . Alexey Kurakin, et al. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016."},{"key":"e_1_3_2_1_7_1","volume-title":"The mnist database of handwritten digits","author":"LeCun Yann","year":"1998","unstructured":"Yann LeCun The mnist database of handwritten digits , 1998 . Yann LeCun et al. The mnist database of handwritten digits, 1998."},{"key":"e_1_3_2_1_8_1","volume-title":"Testing Statistical Hypotheses","author":"Lehmann Erich L.","year":"2008","unstructured":"Erich L. Lehmann , Testing Statistical Hypotheses . Springer Texts in Statistics, August 2008 . Erich L. Lehmann, et al. Testing Statistical Hypotheses. Springer Texts in Statistics, August 2008."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of the 37th IEEE Symposium on Security and Privacy.","author":"Papernot Nicolas","unstructured":"Nicolas Papernot , Distillation as a defense to adversarial perturbations against deep neural networks . In Proceedings of the 37th IEEE Symposium on Security and Privacy. Nicolas Papernot, et al. Distillation as a defense to adversarial perturbations against deep neural networks. In Proceedings of the 37th IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.20"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"e_1_3_2_1_14_1","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy , Intriguing properties of neural networks . In Proceedings of the International Conference on Learning Representations , 2014 . Christian Szegedy, et al. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations, 2014."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3147.3165"},{"key":"e_1_3_2_1_17_1","volume-title":"Advanced Structured Prediction","author":"Warde-Farley D","year":"2016","unstructured":"D Warde-Farley , Adversarial perturbations of deep neural networks . Advanced Structured Prediction , 2016 . D Warde-Farley, et al. Adversarial perturbations of deep neural networks. Advanced Structured Prediction, 2016."},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of the 2016 Network and Distributed Systems Symposium.","author":"Xu Weilin","unstructured":"Weilin Xu , Automatically evading classifiers . In Proceedings of the 2016 Network and Distributed Systems Symposium. Weilin Xu, et al. Automatically evading classifiers. In Proceedings of the 2016 Network and Distributed Systems Symposium."}],"event":{"name":"ASIA CCS '17: ACM Asia Conference on Computer and Communications Security","location":"Abu Dhabi United Arab Emirates","acronym":"ASIA CCS '17","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3052973.3053009","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3052973.3053009","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3052973.3053009","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:36:58Z","timestamp":1750203418000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3052973.3053009"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,4,2]]},"references-count":18,"alternative-id":["10.1145\/3052973.3053009","10.1145\/3052973"],"URL":"https:\/\/doi.org\/10.1145\/3052973.3053009","relation":{"is-referenced-by":[{"id-type":"doi","id":"10.36227\/techrxiv.24208722.v1","asserted-by":"object"},{"id-type":"doi","id":"10.36227\/techrxiv.24208722.v2","asserted-by":"object"},{"id-type":"doi","id":"10.36227\/techrxiv.24208722","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2017,4,2]]},"assertion":[{"value":"2017-04-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}